Deterministic and Highly Efficient Quantum Cryptography with Entangled Photon Pairs 
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We present a protocol for deterministic and highly efficient quantum cryptography with entangled pho- 
ton pairs in a 4 x 4-dimentional Hilbert space. Two communicating parties, Alice and Bob first share a both 
polarization- and path-entangled photon pair, and then each performs a complete Bell-state measurement 
on their own photon in one of two complementary Bell-state bases. It is demonstrated that each measure- 
ment in which both Alice and Bob register a photon can build certain perfect correlation and generate 1.5 
key bits on average. The security of our protocol is guaranteed by the non-cloning theorem. 

PACS numbers: 03.67.Lx, 42.50.Ai 



The central task for quantum cryptography is to establish 
secure keys before the transmission of message between 
two parties In recent years, both BB84 lyh and Ek- 
ert91 [3] cryptographic protocols have been successfully 
demonstrated in numerous experiments |4l bl la Li la l2D- 
However, one drawback of the above schemes is the non- 
deterministic feature, that is, only less than 50% of all de- 
tected qubits can be further used as key bits. This is a seri- 
ous practical problem, because in the one-time-pad secret- 
key cryptosystem, the length of secret key must be the same 
as the ciphertext lli (li . Although some deterministic cryp- 
tographic schemes based on orthogonal states have been 
proposed recently ifTTl [Ï2l IÏ3ll . the long storage rings re- 
quired, which is an essential ingredient of those schemes, 
lead to a low efficiency for the transmission of polarized 
photons. More recently, deterministic quantum cryptog- 
raphy and secret direct communication have also been pro- 
posed with single-photon two-qubit states II 1411 . By exploit- 
ing the states in four- or more dimensional Hilbert space, 
each transmitted photon can be used as a key bit with the 
help of classical communication; eavesdroppers can be de- 
tected within the scheme. However, every photon detected 
can establish only one key bit. 

In this work, we propose a deterministic and highly effi- 
cient quantum cryptography protocol using doubly entan- 
gled photon pairs lll5lllfll . In the scheme, two communi- 
cating parties, Alice and Bob, first share a polarization- and 
path-entangled photon pair, then each performs a complete 
Bell measurement on Alice's (Bob's) photon in one of two 
complementary Bell bases. In this way, they can estab- 
lish 1.5 key bits on average for each measurement where 
both Alice and Bob register a single photon. We also show 
that the security of our protocol is guaranteed by the non- 
cloning theorem. 

In order to establish a key bit at each run - that is - in 
a determinstic way, it would require that, on the one hand, 
each assigned joint measurement must generate certain per- 
fect correlations between two communicating parties; and 
on the other hand, some of these perfect correlations are 
sufficient to perform the validation of eavesdropper. Our 
quantum cryptography protocol is based on this observa- 
tion. Although it is not possible to contruct such a protocol 



for two observers with only one Einstein-Poldolsky-Rosen 
(EPR) pair, one can indeed achieve this goal using two EPR 
pairs, provided that one can achieve the controlled-NOT 
operation between two indepedent photons [17]. 

In our scheme, instead of utilizing two EPR pairs, we 
make use of only one photon pair where the two photons 
are entangled both in polarization and in path degree of 
freedom II 1611 . In contrast to the two pair scheme, there 
are two obvious advantages in our single pair scheme. 
First, the required complete Bell-state measurement which 
projects Alice's (Bob's) photon onto a polarization-path 
entangled state in one of two complementary bases is fea- 
sible with only linear òptics and, actually, has been ex- 
perimentally implemented lfl8ll . Second, using two usual 
polarization-entangled photon pairs will lead to very low 
efficiency due to the very low probability of simultane- 
ously generating two entangled photon pairs. Our scheme 
is deterministic in the sense that all measurements in which 
both Alice and Bob register a photon can be used to estab- 
lish perfect correlations, which can then be converted into 
key bits and a few of them are enough to perform the de- 
tection of any eavesdroppers. Entanglement exploited in 
the present scheme is used both to provide security against 
eavesdropping and to enhance the key bit generation. 

We now explain how our scheme works. As shown 
in Fig. 1, two communicating parties, Alice and Bob, 
first share a both polarization- and path-entangled photon 
pair. It can be generated using parametric down conver- 
sion (PDC) by the method described in Ref. I19T . As ex- 
plained in refs. lfÏ5lfïr3l . after the UV làser passes through 
the BBO crystal twice, the state corresponding to the case 
where there is one and only one pair production is given by 

I*)a 1B2 = ^(I^)iI^) 2 -I^)iI^) 2 ) 

® (K) |6a) - |6í) los)) . (1) 

\H) 1 and \ V) Í represent the polarization states of photon 
1 in path ai or b\, and \H) 2 and \V) 2 represent the states 
of photon 2 in path a 2 or ò 2 . Then let photon 1 in path a\ 
and b\ move towards Alice and photon 2 in path o 2 and b 2 
towards Bob. With such state Alice and Bob can perform 
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FIG. 1 : Schematic diagram of generating both polarization- and 
path-entangled photon pairs and performing the complete Bell 
measurement in one of the two complentary bases. Rgo and R45 
are half-wave plates that rotating the polarization of photons by 
90° and 45° respectively. When inserting R90 into the mode ai 
(or b2), Alice (or Bob) can perforin the complete Bell-state mea- 
surement on the state of j | $ ± ) „ , | ^ ^ ) ^. j . When inserting two 

45°s into the modes ai and bi (or a.2 and b2) simultaneously, Al- 
ice (or Bob) can perform the complete Bell-state measurement on 



the state of 
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entanglement swapping or all-versus-nothing test 

of quantum mechanics against local realism lila Í17II . In 
the following, we are going to show how entanglement 
swapping of the quantum state \^) A1B2 provides us a 
deterministic and efficient quantum cryptography. 

In order to establish secure key bits between Alice 
and Bob, they can randomly choose one of two com- 

plementary Bell-state bases || < I )± ) Í1 , |W ± ) Í1 - j (type-I) 



or 
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( | (type-II) (íj = Al or B2) and then 

perform Bell-state measurement. The two Bell-state bases 
are defined as following: 
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The Bell states in the two complementary bases satisfy the 
following relations 
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where \-) A1 and \-} B2 represent the quantum states to be 
measured by Alice and Bob, respectively. Because the Bell 
states are polarization and path entangled, the complete 
Bell-state measurement can be done with only linear òptics 
II 1811 . This feature is essential to our deterministic quantum 
cryptography protocol. After the measurements have taken 
place, Alice and Bob can announce in públic which type 
of Bell bases they have used, and then divide the measure- 
ments into two sub-groups: For the first group they use the 



same Bell bases, and for the second group they use the dif- 
ferent Bell bases. Of course, owing to the limited detection 
efficiency they only consider those events in which both 
Alice and Bob successfully register a single photon. 

Let us first consider what will happen when Alice and 
Bob use the same Bell bases, i.e., they use either type-I 
or type-II Bell base. In this case the state \^) A1B2 of Al- 
ice and Bob, according to entanglement swapping, can be 
rewritten in the two Bell bases as 
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Eq. (5) implies that, whenever Alice obtain a measure- 
ment result, Bob will always obtain the same result as long 
as his measurement is performed in the same Bell bases. 
Therefore, perfect correlations can be built for those cases 
in which both of them perform a measurement on their own 
particle in the same Bell bases. 

If Alice and Bob use different Bell bases (i.e., type-I and 
type-II Bell bases), the total state of Alice and Bob can be 
rewritten as either 
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The above two equations imply the following: Any spe- 
cific outcome obtained by Alice or Bob in one of the two 
bases is maximally random and as such, given two specific 
outcomes of measurements in one type of the Bell bases 
obtained by Alice, she can predict with certainty the two 
outcomes of the corresponding measurements performed 
by Bob in another Bell bases and vice versa. For example, 
whenever Alice obtains one of the two Bell states | <ï> + ) and 
\^~) (or l^ - ) and |\& + )), Bob's photon will be in one of 
the two states and \x~) ( or \ íjJ ~) an d lx + ))- Thus, 
Alice and Bob can always build two kinds of correlations 
in different bases. 

Since a deterministic correlation can be built for every 
joint measurement, all outcomes of the measurements in 
the same or different bases can be further used as key bits. 
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This is the essential property of our deterministic quantum 
cryptography protocol and is different from the existing 
schemes with two-dimensional entangled photon pairs. 

Having established that deterministic correlations can be 
built between two communicating parties, let us show how 
to generate the key bits in the present protocol. First, if 
Alice and Bob have used the different bases, they can then 
simply define the two kinds of correlations as and 1. For 
example, in the case of that Alice performs a measurement 

in the < l^),, , l 1 ^*),-,- I" bases and Bob performs a mea- 

surement in the ^Ix^y j l w± )y } bases, Alice can define 
the two Bell states |$+) and |^ _ ) as and |$~) and |* + ) 
as 1, while Bob can define the two states |cj + ) and \x~) as 
and |üj~) and \ x + ) as 1- Thus in this case, one key bit can 
be built. Second, if they use the same Bell bases, they actu- 
ally receive two bits of deterministic information from the 
measurements since there are 4 possible outcomes of mea- 
surements in any one of the two Bell bases. They can agree 
with each other in advance that the Bell states (| <£> + ), | $~), 
l^ - )) and Ix - )' l ÜJ+ )' l"-^ - )) are encoded as 

two bits 00, 01, 10 and 11. Thus in the latter case, two key 
bits can be built. Since the probabilities that Alice and Bob 
perform the mesaurement in different Bell bases and in the 
same Bell bases are the same, i.e. 50%, every measure- 
ment in which both of Alice and Bob register a photon can 
establish 1.5 key bits on average. Therefore, by exploit- 
ing the high-capacity encoding method, the above scheme 
can provide a more efficient quantum cryptography than 
the existing deterministic ones. 

Let us now discuss the security of the scheme. For sim- 
plicity, suppose that an eavesdropper, Eve, has full access 
to the quantum channel between Alice and Bob, Eve can 
thus make use of intercept-resend attack. He can first ran- 
domly perform a Bell-state measurement on the photon 2 
in the two complementary bases and then send its replace- 
ment to Bob. However, when Alice performs a Bell-state 
measurement on her photon by randomly choosing one of 
the two complementary bases, she equivalently prepares a 
mixture of some nonorthogonal states with equal probabil- 
ity. Owing to the limit of the non-cloning theorem ll22ll . it is 
not possible for Eve to know which basis Alice has chosen. 
Indeed, Eve can at most get 50% information, while Alice 
and Bob have about 25% error rate in the key bits obtained 
(US- By announcing and comparing in públic some out- 
comes of the measurements in the same bases, Alice and 
Bob can thus easily detect the presence of Eve. 

However, Eve can also perform another type of 
intercept-resend attack. Eve can first randomly perform 
a Bell-state measurement on both photons in one of the 
two complementary bases and then send its replacements 
to Alice and Bob, respectively. In this case, since any mea- 
surement performed by Eve will destroy the original en- 
tanglement between the two photons, the measurement re- 
sults obtained by Alice and Bob during the verifictaion of 



entanglement swapping will be inconsistent with the pre- 
dictions of quantum mechanics. Specifically, by compar- 
ing the outcome of the measurement in the same Bell-state 
bases, in a single run Alice and Bob will detect the eaves- 
dropper with the probability of 1 /4 whenever Eve performs 
the Bell measurements in the same Bell bases and with the 
probability of 1 /2 whenever Eve performs the Bell mea- 
surements in the different bases. By announcing and com- 
paring in públic some outcomes of the measurements in 
the same bases, again Alice and Bob can easily detect the 
presence of Eve. 

As pointed out in Ref. JÏ6ll . the state \^) A1B2 use d 
in our protocol is effectively a maximally entangled state 
in a 4 x 4-dimensional Hilbert space. Essentially, the 
scheme presented here is thus a high-dimensional quan- 
tum cryptography protocol. In contrast to the former 
high-dimensional quantum cryptography protocols where 
the protocols provide better security against eavesdropping 
than the low-dimensional ones while lead to a low gen- 
eration rate of key bits ll23l l24l I25L Eól l27ll . our protocol 
not only provides better security against eavesdropping but 
also has a higher generation rate of key bits than the low- 
dimensional ones. 

Compared with Ekert's quantum cryptography protocol 
using EPR-entangled qubit states |3], a striking feature 
of the present scheme is its higher efficiency. In Ekert's 
scheme, in order to be against eavesdropping, Alice and 
Bob randomly perform statistical measurements and reg- 
ister the outcomes in one of three nonorthogonal bases. 
When they have used the same bases incidentally, the re- 
sults are correlated or anticorrelated and can be converted 
into key bits. For the others the results is not correlated and 
therefore used only for checking whether there is eaves- 
dropper with help of Bell's inequalities. Thus, the overall 
probability of creating a key bit is 2/9 per pair. However, 
in our scheme each measurement in which both of Alice 
and Bob register a photon simultaneously can generate 1.5 
key bits on average. Thus, the key bit generation efficiency 
per pair is 27/4 times higher in our scheme than in Akert's. 

In summary, we have presented a protocol for determin- 
istic and efficient quantum cryptography with two photons 
that are entangled in both polarization and path degrees of 
freedom. The protocol can establish 1.5 key bits per en- 
tangled pair, which is almost one order of magnitude (~ 7 
times) higher than the Akert's scheme and is completely 
secure against eavesdrop ping . The polarization- and path- 
entangled photon pairs 1 19] and the complete Bell-state 
measurement ifï^l are two bàsic ingredients of the pro- 
posed protocol. Thus, our scheme is feasible and within 
the reach of current technology. The experimental realiza- 
tion of the protocol is under way in our lab. 
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